Integration

Cloudflare

HTTP requests and firewall events from Logpush: status, cache, origin time, clients.

Category: Cloud
How data is sent: The service sends its logs (HTTPS, nothing to install)
Status: Beta

How it works#

Answer a few questions. They only fill in the setup steps. Logthread never signs in to your Cloudflare account.
Create a Logpush job for your zone. The next page shows the endpoint with this connector's ingest key filled in. There is nothing to install.
Data arrives. Cloudflare sends the logs over HTTPS to ingest.logthread.com with this connector's key. The connection page shows what has arrived and turns Active with the first record.

What you answer#

Question	Answer	Notes
Logs to send	`http_requests` (HTTP requests), `firewall_events` (Firewall events)	Default: `http_requests`.
Zone ID (optional)	Text	On the zone's Overview page, under API.
Service name (optional)	Text	Every record gets this service name unless it names its own. Leave empty to name services automatically.

Setup#

These are the steps for the default answers. In the app, they follow your answers, and the connector's ingest key replaces YOUR_INGEST_KEY.

Step 1. Create a Cloudflare API token. In the Cloudflare dashboard: My Profile, API Tokens, Create Token, Custom token, with the permission Zone, Logs, Edit for this zone. It is used once, by the next command, and never sent to Logthread.

Step 2. Create the Logpush job. It asks for the token (hidden). Cloudflare first checks the destination with a test upload, then sends the zone's HTTP requests in batches, with the fields the dashboard uses.

printf 'Cloudflare API token: '; stty -echo; read -r CF_API_TOKEN; stty echo; echo
curl -sS https://api.cloudflare.com/client/v4/zones/<zone id>/logpush/jobs \
  -H "Authorization: Bearer $CF_API_TOKEN" -H "Content-Type: application/json" \
  -d '{
  "name": "logthread-http-requests",
  "dataset": "http_requests",
  "enabled": true,
  "destination_conf": "https://ingest.logthread.com/v1/integrations/cloudflare?dataset=http_requests&header_Authorization=Bearer%20YOUR_INGEST_KEY",
  "output_options": {
    "field_names": [
      "CacheCacheStatus",
      "ClientCountry",
      "ClientIP",
      "ClientRequestHost",
      "ClientRequestMethod",
      "ClientRequestPath",
      "ClientRequestURI",
      "ClientRequestUserAgent",
      "EdgeResponseBytes",
      "EdgeResponseStatus",
      "EdgeStartTimestamp",
      "OriginResponseDurationMs",
      "OriginResponseStatus",
      "RayID"
    ],
    "timestamp_format": "rfc3339"
  }
}'
unset CF_API_TOKEN

Step 3. Wait for data. Logpush sends a batch about every 30 seconds while the zone has traffic. The response to the command shows the job id; "success": true means it was created.

Check that it works#

The connection page under Integrations counts the records sent with the connector's key and turns Active with the first one.

Then add#

Each is one click on the connection page and opens with your data, so you can check it before saving.

Dashboard: Cloudflare: HTTP requests by status and cache status, 5xx, origin latency, and the top hosts, failing paths and client addresses from Logpush.
Alert: Cloudflare 5xx responses: logthread.source:cloudflare_logpush EdgeResponseStatus>=500, at least 50 in 10 minutes
Alert: Cloudflare blocked requests: logthread.source:cloudflare_logpush Action:block, at least 100 in 10 minutes

Set it up under Integrations in the app, or from an AI agent with MCP (add_integration). All integrations: Integrations guide. Next: find what it sends in Explore and live tail.